On SPA-platform cars like a 2018 S90, the OBD-II port sits behind the CEM/central gateway, so you’ll see some high-speed CAN at the port but it’s filtered, and the comfort/body CAN is generally not mirrored there. You’ll usually catch powertrain/chassis chatter and diagnostics on pins 6/14, but don’t expect the mid/low-speed body traffic on pins 3/11 the way older Volvos did, SPA leans on DoIP for a lot of diagnostics, so comfort CAN isn’t exposed at the OBD.
If you want clean captures, plan on one tap for HS-CAN and another for the comfort bus. For HS, the easiest non-invasive access is the ABS/BCM connector in the engine bay or the harness at the under-hood fuse/relay box; both sit on the 500 kbps network and are easy to reach. For the comfort/body network, the neatest access is usually at the REM (left rear trunk/quarter behind the trim) or at the CEM behind/under the glovebox on LHD cars. Door modules ride that same bus, but fishing into the A-pillar/door loom is more fiddly than popping the REM panel. Use pass-through pigtails or insulation-displacement clips so you don’t cut the loom; keep the twist intact and only expose a few millimeters.
You won’t see the key fob’s RF itself on CAN, the immobilizer and LF/RF challenge/response are off-bus, but the effects of a button press are. If you sniff near the REM or CEM and press lock/unlock, you’ll see a small burst of frames that toggle bits for door-lock state, alarm arming, hazard flash, and similar. Remote start on SPA is mediated by the telematics/CEM with security access (seed/key), so you can observe state changes but actually commanding a start isn’t a single unauthenticated CAN message. Start in listen-only; injecting on a live SPA network can set a pile of DTCs or worse.
For SavvyCAN, run two channels concurrently: one at 500 kbps for HS-CAN and one at 125 kbps for the comfort bus. Before logging, sanity-check the wiring: across the tapped pair you should read roughly 60 Ω with ignition off (two 120 Ω terminators in parallel), and with ignition on you’ll see the usual ~2.5 V bias with H/L diverging during traffic. Record a baseline, then press LOCK a few times followed by UNLOCK to create clear deltas; filtering for frames that appear or change only during those moments will get you to the candidate IDs quickly.
If you want exact connector cavities, wire colors, and splice locations, pull the wiring diagrams for your VIN in VIDA, look for the “High-Speed CAN topology” and “Interior/Body CAN topology” pages. That’ll give you precise REM/CEM connector labels so you can make a tidy, reversible breakout.